🚨 Microsoft Azure: three CVSS 10.0s published Oct 22. All fully mitigated server-side. No patch. No affected version. No date the flaw existed.
CVE-2026-83938 — AKS Config Service (CWE-306, 10.0)
CVE-2026-97785 — AAD App Proxy (CWE-287, 10.0)
CVE-2026-110063 — VM Inspector (CWE-59, 10.0)
"Fully mitigated, no action" ends the remediation story. It doesn't answer: was my tenant touched before the fix landed?
No exposure window = unauditable.
Also in the batch: CVE-2026-105014, Azure Pipelines, CWE-77 command injection, 9.1 — customer-actionable. Don't let three unpatchable 10.0s crowd it out.
https://threataft.com/articles/microsoft-azure-double-10-cve-2026-83938-97785
ThreatAftAzure Double 10.0: No Patch, No Action, No Date | ThreatAftMicrosoft's Azure double 10.0 (CVE-2026-83938, CVE-2026-97785) has no patch and no action. Why 'fully mitigated' still needs verification.